HostGator Blog

Web Hosting Made Easy!

Heartbleed Bug

You may have now heard of the “Heartbleed Bug.” Before we continue, we want to reassure you that if you are hosting on a HostGator shared or reseller server, that your server has already been patched. For everyone else, HostGator customer or not, we have created the following tool to assist you with determining whether or not your site is presently vulnerable and what further action to take, if necessary: https://heartbleed.hostgator.com/

Note: This tool has been continued as of 3/4/16. If you have any questions about the 2014 Heartbleed bug, please consult the Heartbleed Wikipedia article.

Now, what exactly is the Heartbleed Bug? Technically speaking, it is a serious vulnerability in the popular OpenSSL cryptographic software library. In layman’s terms, it allows the ever-present nefarious individuals the ability to intercept and decode encrypted data. The following quote comes from heartbleed.com:

“The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.”

The bug is so-named due to a normal function between two computers across a network (such as the Internet) sharing an encrypted connection. The “heartbeat” is simply a pulse, or packet of information, sent from one machine to the other to ensure the connection still exists. This functionality is what allows the exploit to occur, in that the heartbeat is simulated by a third party in such a way as to allow them access to the memory of the receiving server.

What this translates to is virtually unlimited, and untraceable, access to a myriad of private information which potentially can include usernames, passwords, and even credit card information. The full extent of the situation is not presently known. What is known is that we should all consider all of our passwords to be compromised. As a result, you absolutely want to update any passwords for anything and everything you log into online. However, if you change your password for an account on a server that has not been patched, then you can consider the new password compromised as well.

Thanks for this update. Do we need to change all of our HostGator passwords (account, domain, email, mysql, etc?)

LaurelNev

10 April 2014 at
6:55 pm

I have the same question. Commenting so Disqus will notifty me when there is a response. :)

HostGator

11 April 2014 at
9:10 am

While we have no evidence to indicate any compromise within our network has taken place, we do recommend taking this opportunity to change all of your passwords, simply because it is a good practice to maintain.

badycool

11 April 2014 at
3:35 am

This is scary…..I’had just changed my critical accounts password as this issue raised

Mitesh Ganatra

11 April 2014 at
6:15 pm

Also, following is recommended:

– Generate a new SSL/TLS key and re-issue a new certificate for the new key. (An attacker could potentially have your old key.)

– Have your users, and you, change the passwords used to log in to your site. It is advisable to change all sensitive user ID’s and Passwords that you may use.